localrepo: Enable WriteCommit to sign

Teach the localrepo WriteCommit API to sign commits if a signing key is
provided.

Also adjust merge and submodule tests to test with the feature flag.

9 files changed, 252 insertions, 40 deletions

diff --git a/internal/git/localrepo/commit.go b/internal/git/localrepo/commit.go
index ca87c8bab..33b5e6dd8 100644
--- a/internal/git/localrepo/commit.go
+++ b/internal/git/localrepo/commit.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 	"time"
 
+	"gitlab.com/gitlab-org/gitaly/v16/internal/featureflag"
 	"gitlab.com/gitlab-org/gitaly/v16/internal/git"
 	"gitlab.com/gitlab-org/gitaly/v16/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v16/internal/helper/text"
@@ -44,6 +45,7 @@ type WriteCommitConfig struct {
 	TreeEntries        []TreeEntry
 	TreeID             git.ObjectID
 	AlternateObjectDir string
+	SigningKey         string
 }
 
 func validateWriteCommitConfig(cfg WriteCommitConfig) error {
@@ -121,16 +123,25 @@ func (repo *Repo) WriteCommit(ctx context.Context, cfg WriteCommitConfig) (git.O
 
 	var stdout, stderr bytes.Buffer
 
+	opts := []git.CmdOpt{
+		git.WithStdout(&stdout),
+		git.WithStderr(&stderr),
+		git.WithStdin(strings.NewReader(cfg.Message)),
+		git.WithEnv(env...),
+	}
+
+	if featureflag.GPGSigning.IsEnabled(ctx) && cfg.SigningKey != "" {
+		flags = append(flags, git.Flag{Name: "--gpg-sign=" + cfg.SigningKey})
+		opts = append(opts, git.WithGitalyGPG())
+	}
+
 	if err := repo.ExecAndWait(ctx,
 		git.Command{
 			Name:  "commit-tree",
 			Flags: flags,
 			Args:  commitArgs,
 		},
-		git.WithStdout(&stdout),
-		git.WithStderr(&stderr),
-		git.WithStdin(strings.NewReader(cfg.Message)),
-		git.WithEnv(env...),
+		opts...,
 	); err != nil {
 		if strings.Contains(stderr.String(), "name consists only of disallowed characters") {
 			return "", ErrDisallowedCharacters
diff --git a/internal/git/localrepo/commit_test.go b/internal/git/localrepo/commit_test.go
index e2581bffc..0ea8966e4 100644
--- a/internal/git/localrepo/commit_test.go
+++ b/internal/git/localrepo/commit_test.go
@@ -2,28 +2,46 @@ package localrepo
 
 import (
 	"bytes"
+	"context"
 	"fmt"
 	"strings"
 	"testing"
 	"time"
 
+	"github.com/ProtonMail/go-crypto/openpgp"
+	"github.com/ProtonMail/go-crypto/openpgp/packet"
 	"github.com/stretchr/testify/require"
+	"gitlab.com/gitlab-org/gitaly/v16/internal/featureflag"
 	"gitlab.com/gitlab-org/gitaly/v16/internal/git"
 	"gitlab.com/gitlab-org/gitaly/v16/internal/git/gittest"
+	"gitlab.com/gitlab-org/gitaly/v16/internal/gpg"
 	"gitlab.com/gitlab-org/gitaly/v16/internal/helper/text"
 	"gitlab.com/gitlab-org/gitaly/v16/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v16/internal/testhelper/testcfg"
 )
 
+//go:generate rm -rf testdata/gpg-keys testdata/signing_gpg_key testdata/signing_gpg_key.pub
+//go:generate mkdir -p testdata/gpg-keys
+//go:generate chmod 0700 testdata/gpg-keys
+//go:generate gpg --homedir testdata/gpg-keys --generate-key --batch testdata/genkey.in
+//go:generate gpg --homedir testdata/gpg-keys --export --output testdata/signing_gpg_key.pub
+//go:generate gpg --homedir testdata/gpg-keys --export-secret-keys --output testdata/signing_gpg_key
+
 func TestWriteCommit(t *testing.T) {
-	t.Helper()
+	t.Parallel()
+	testhelper.NewFeatureSets(featureflag.GPGSigning).Run(t, testWriteCommit)
+}
 
+func testWriteCommit(t *testing.T, ctx context.Context) {
+	t.Helper()
 	cfg := testcfg.Build(t)
-	ctx := testhelper.Context(t)
 
 	repoProto, repoPath := gittest.CreateRepository(t, ctx, cfg, gittest.CreateRepositoryConfig{
 		SkipCreationViaService: true,
 	})
+
+	testcfg.BuildGitalyGPG(t, cfg)
+
 	repo := NewTestRepo(t, cfg, repoProto)
 
 	blobID, err := repo.WriteBlob(ctx, "file", bytes.NewBufferString("something"))
@@ -184,6 +202,7 @@ func TestWriteCommit(t *testing.T) {
 	} {
 		t.Run(tc.desc, func(t *testing.T) {
 			oid, err := repo.WriteCommit(ctx, tc.cfg)
+
 			require.Equal(t, tc.expectedError, err)
 			if err != nil {
 				return
@@ -200,11 +219,59 @@ func TestWriteCommit(t *testing.T) {
 			}
 		})
 	}
+
+	t.Run("signed", func(tb *testing.T) {
+		if !featureflag.GPGSigning.IsEnabled(ctx) {
+			tb.Skip()
+		}
+
+		cfg := WriteCommitConfig{
+			TreeID:         treeA.OID,
+			AuthorName:     gittest.DefaultCommitterName,
+			AuthorEmail:    gittest.DefaultCommitterMail,
+			CommitterName:  gittest.DefaultCommitterName,
+			CommitterEmail: gittest.DefaultCommitterMail,
+			AuthorDate:     gittest.DefaultCommitTime,
+			CommitterDate:  gittest.DefaultCommitTime,
+			Message:        "my custom message",
+			SigningKey:     "testdata/signing_gpg_key",
+		}
+
+		oid, err := repo.WriteCommit(ctx, cfg)
+		require.Nil(t, err)
+
+		commit, err := repo.ReadCommit(ctx, git.Revision(oid))
+		require.NoError(t, err)
+
+		require.Equal(t, gittest.DefaultCommitAuthor, commit.Author)
+		require.Equal(t, "my custom message", string(commit.Body))
+
+		data, err := repo.ReadObject(ctx, oid)
+		require.NoError(t, err)
+
+		gpgsig, dataWithoutGpgSig := gpg.ExtractSignature(t, ctx, data)
+
+		pubKey := testhelper.MustReadFile(tb, "testdata/signing_gpg_key.pub")
+		keyring, err := openpgp.ReadKeyRing(bytes.NewReader(pubKey))
+		require.NoError(tb, err)
+
+		_, err = openpgp.CheckArmoredDetachedSignature(
+			keyring,
+			strings.NewReader(dataWithoutGpgSig),
+			strings.NewReader(gpgsig),
+			&packet.Config{},
+		)
+		require.NoError(tb, err)
+	})
 }
 
 func TestWriteCommit_validation(t *testing.T) {
+	t.Parallel()
+	testhelper.NewFeatureSets(featureflag.GPGSigning).Run(t, testWriteCommitValidation)
+}
+
+func testWriteCommitValidation(t *testing.T, ctx context.Context) {
 	cfg := testcfg.Build(t)
-	ctx := testhelper.Context(t)
 
 	repoProto, _ := gittest.CreateRepository(t, ctx, cfg, gittest.CreateRepositoryConfig{
 		SkipCreationViaService: true,
diff --git a/internal/git/localrepo/testdata/.gitignore b/internal/git/localrepo/testdata/.gitignore
new file mode 100644
index 000000000..ce54783f6
--- /dev/null
+++ b/internal/git/localrepo/testdata/.gitignore
@@ -0,0 +1 @@
+gpg-keys/
diff --git a/internal/git/localrepo/testdata/genkey.in b/internal/git/localrepo/testdata/genkey.in
new file mode 100644
index 000000000..ca2739327
--- /dev/null
+++ b/internal/git/localrepo/testdata/genkey.in
@@ -0,0 +1,10 @@
+%no-protection
+Key-Type: DSA
+Key-Length: 1024
+Subkey-Type: ECDSA
+Subkey-Curve: nistp256
+Name-Real: John Cai
+Name-Email: jcai@gitlab.com
+Expire-Date: 0
+Subkey-Length: 256
+%commit
diff --git a/internal/git/localrepo/testdata/signing_gpg_key b/internal/git/localrepo/testdata/signing_gpg_key
new file mode 100644
index 000000000..e40953ebc
--- /dev/null
+++ b/internal/git/localrepo/testdata/signing_gpg_key
diff --git a/internal/git/localrepo/testdata/signing_gpg_key.pub b/internal/git/localrepo/testdata/signing_gpg_key.pub
new file mode 100644
index 000000000..49d6fc488
--- /dev/null
+++ b/internal/git/localrepo/testdata/signing_gpg_key.pub
diff --git a/internal/gitaly/service/operations/commit_files_test.go b/internal/gitaly/service/operations/commit_files_test.go
index c7d5ccfb6..4ad7641b3 100644
--- a/internal/gitaly/service/operations/commit_files_test.go
+++ b/internal/gitaly/service/operations/commit_files_test.go
@@ -34,8 +34,10 @@ var commitFilesMessage = []byte("Change files")
 func TestUserCommitFiles(t *testing.T) {
 	t.Parallel()
 
-	testhelper.NewFeatureSets(featureflag.CommitFilesInGit).
-		Run(t, testUserCommitFiles)
+	testhelper.NewFeatureSets(
+		featureflag.CommitFilesInGit,
+		featureflag.GPGSigning,
+	).Run(t, testUserCommitFiles)
 }
 
 func testUserCommitFiles(t *testing.T, ctx context.Context) {
@@ -972,8 +974,10 @@ func testUserCommitFiles(t *testing.T, ctx context.Context) {
 func TestUserCommitFilesStableCommitID(t *testing.T) {
 	t.Parallel()
 
-	testhelper.NewFeatureSets(featureflag.CommitFilesInGit).
-		Run(t, testUserCommitFilesStableCommitID)
+	testhelper.NewFeatureSets(
+		featureflag.CommitFilesInGit,
+		featureflag.GPGSigning,
+	).Run(t, testUserCommitFilesStableCommitID)
 }
 
 func testUserCommitFilesStableCommitID(t *testing.T, ctx context.Context) {
@@ -1034,8 +1038,10 @@ func testUserCommitFilesStableCommitID(t *testing.T, ctx context.Context) {
 func TestUserCommitFilesQuarantine(t *testing.T) {
 	t.Parallel()
 
-	testhelper.NewFeatureSets(featureflag.CommitFilesInGit).
-		Run(t, testUserCommitFilesQuarantine)
+	testhelper.NewFeatureSets(
+		featureflag.CommitFilesInGit,
+		featureflag.GPGSigning,
+	).Run(t, testUserCommitFilesQuarantine)
 }
 
 func testUserCommitFilesQuarantine(t *testing.T, ctx context.Context) {
@@ -1090,7 +1096,10 @@ func testUserCommitFilesQuarantine(t *testing.T, ctx context.Context) {
 func TestSuccessfulUserCommitFilesRequest(t *testing.T) {
 	t.Parallel()
 
-	testhelper.NewFeatureSets(featureflag.CommitFilesInGit).
+	testhelper.NewFeatureSets(
+		featureflag.CommitFilesInGit,
+		featureflag.GPGSigning,
+	).
 		Run(t, testSuccessfulUserCommitFilesRequest)
 }
 
@@ -1245,7 +1254,10 @@ func testSuccessfulUserCommitFilesRequest(t *testing.T, ctx context.Context) {
 func TestSuccessfulUserCommitFilesRequestMove(t *testing.T) {
 	t.Parallel()
 
-	testhelper.NewFeatureSets(featureflag.CommitFilesInGit).
+	testhelper.NewFeatureSets(
+		featureflag.CommitFilesInGit,
+		featureflag.GPGSigning,
+	).
 		Run(t, testSuccessfulUserCommitFilesRequestMove)
 }
 
@@ -1304,10 +1316,13 @@ func testSuccessfulUserCommitFilesRequestMove(t *testing.T, ctx context.Context)
 	}
 }
 
-func TestSuccessfulUserCommitFilesRequestForceCommit(t *testing.T) {
+func TestSuccessUserCommitFilesRequestForceCommit(t *testing.T) {
 	t.Parallel()
 
-	testhelper.NewFeatureSets(featureflag.CommitFilesInGit).
+	testhelper.NewFeatureSets(
+		featureflag.CommitFilesInGit,
+		featureflag.GPGSigning,
+	).
 		Run(t, testSuccessUserCommitFilesRequestForceCommit)
 }
 
@@ -1353,10 +1368,13 @@ func testSuccessUserCommitFilesRequestForceCommit(t *testing.T, ctx context.Cont
 	require.Equal(t, newTargetBranchCommit.ParentIds, []string{startBranchCommit.Id})
 }
 
-func TestSuccessUserCommitFilesRequestForceCommit(t *testing.T) {
+func TestSuccessUserCommitFilesRequestStartSha(t *testing.T) {
 	t.Parallel()
 
-	testhelper.NewFeatureSets(featureflag.CommitFilesInGit).
+	testhelper.NewFeatureSets(
+		featureflag.CommitFilesInGit,
+		featureflag.GPGSigning,
+	).
 		Run(t, testSuccessUserCommitFilesRequestStartSha)
 }
 
@@ -1393,7 +1411,10 @@ func testSuccessUserCommitFilesRequestStartSha(t *testing.T, ctx context.Context
 func TestSuccessUserCommitFilesRequestStartShaRemoteRepository(t *testing.T) {
 	t.Parallel()
 
-	testhelper.NewFeatureSets(featureflag.CommitFilesInGit).
+	testhelper.NewFeatureSets(
+		featureflag.CommitFilesInGit,
+		featureflag.GPGSigning,
+	).
 		Run(t, testSuccessfulUserCommitFilesRemoteRepositoryRequest(func(header *gitalypb.UserCommitFilesRequest) {
 			setStartSha(header, "1e292f8fedd741b75372e19097c76d327140c312")
 		}))
@@ -1402,7 +1423,10 @@ func TestSuccessUserCommitFilesRequestStartShaRemoteRepository(t *testing.T) {
 func TestSuccessUserCommitFilesRequestStartBranchRemoteRepository(t *testing.T) {
 	t.Parallel()
 
-	testhelper.NewFeatureSets(featureflag.CommitFilesInGit).
+	testhelper.NewFeatureSets(
+		featureflag.CommitFilesInGit,
+		featureflag.GPGSigning,
+	).
 		Run(t, testSuccessfulUserCommitFilesRemoteRepositoryRequest(func(header *gitalypb.UserCommitFilesRequest) {
 			setStartBranchName(header, []byte("master"))
 		}))
@@ -1449,7 +1473,10 @@ func testSuccessfulUserCommitFilesRemoteRepositoryRequest(setHeader func(header
 func TestSuccessfulUserCommitFilesRequestWithSpecialCharactersInSignature(t *testing.T) {
 	t.Parallel()
 
-	testhelper.NewFeatureSets(featureflag.CommitFilesInGit).
+	testhelper.NewFeatureSets(
+		featureflag.CommitFilesInGit,
+		featureflag.GPGSigning,
+	).
 		Run(t, testSuccessfulUserCommitFilesRequestWithSpecialCharactersInSignature)
 }
 
@@ -1504,8 +1531,10 @@ func testSuccessfulUserCommitFilesRequestWithSpecialCharactersInSignature(t *tes
 func TestFailedUserCommitFilesRequestDueToHooks(t *testing.T) {
 	t.Parallel()
 
-	testhelper.NewFeatureSets(featureflag.CommitFilesInGit).
-		Run(t, testFailedUserCommitFilesRequestDueToHooks)
+	testhelper.NewFeatureSets(
+		featureflag.CommitFilesInGit,
+		featureflag.GPGSigning,
+	).Run(t, testFailedUserCommitFilesRequestDueToHooks)
 }
 
 func testFailedUserCommitFilesRequestDueToHooks(t *testing.T, ctx context.Context) {
@@ -1557,8 +1586,10 @@ func testFailedUserCommitFilesRequestDueToHooks(t *testing.T, ctx context.Contex
 func TestFailedUserCommitFilesRequestDueToIndexError(t *testing.T) {
 	t.Parallel()
 
-	testhelper.NewFeatureSets(featureflag.CommitFilesInGit).
-		Run(t, testFailedUserCommitFilesRequestDueToIndexError)
+	testhelper.NewFeatureSets(
+		featureflag.CommitFilesInGit,
+		featureflag.GPGSigning,
+	).Run(t, testFailedUserCommitFilesRequestDueToIndexError)
 }
 
 func testFailedUserCommitFilesRequestDueToIndexError(t *testing.T, ctx context.Context) {
@@ -1634,8 +1665,10 @@ func testFailedUserCommitFilesRequestDueToIndexError(t *testing.T, ctx context.C
 func TestFailedUserCommitFilesRequest(t *testing.T) {
 	t.Parallel()
 
-	testhelper.NewFeatureSets(featureflag.CommitFilesInGit).
-		Run(t, testFailedUserCommitFilesRequest)
+	testhelper.NewFeatureSets(
+		featureflag.CommitFilesInGit,
+		featureflag.GPGSigning,
+	).Run(t, testFailedUserCommitFilesRequest)
 }
 
 func testFailedUserCommitFilesRequest(t *testing.T, ctx context.Context) {
@@ -1719,7 +1752,10 @@ func testFailedUserCommitFilesRequest(t *testing.T, ctx context.Context) {
 func TestUserCommitFilesFailsIfRepositoryMissing(t *testing.T) {
 	t.Parallel()
 
-	ctx := testhelper.Context(t)
+	testhelper.NewFeatureSets(featureflag.GPGSigning).Run(t, testUserCommitFilesFailsIfRepositoryMissing)
+}
+
+func testUserCommitFilesFailsIfRepositoryMissing(t *testing.T, ctx context.Context) {
 	ctx, cfg, client := setupOperationsServiceWithoutRepo(t, ctx)
 	repo := &gitalypb.Repository{
 		StorageName:   cfg.Storages[0].Name,
diff --git a/internal/gitaly/service/operations/merge_test.go b/internal/gitaly/service/operations/merge_test.go
index fca046135..debcde76d 100644
--- a/internal/gitaly/service/operations/merge_test.go
+++ b/internal/gitaly/service/operations/merge_test.go
@@ -13,6 +13,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"gitlab.com/gitlab-org/gitaly/v16/internal/featureflag"
 	"gitlab.com/gitlab-org/gitaly/v16/internal/git"
 	"gitlab.com/gitlab-org/gitaly/v16/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/v16/internal/git/localrepo"
@@ -41,7 +42,13 @@ var (
 )
 
 func TestUserMergeBranch(t *testing.T) {
-	ctx, cfg, client := setupOperationsServiceWithoutRepo(t, testhelper.Context(t))
+	t.Parallel()
+
+	testhelper.NewFeatureSets(featureflag.GPGSigning).Run(t, testUserMergeBranch)
+}
+
+func testUserMergeBranch(t *testing.T, ctx context.Context) {
+	ctx, cfg, client := setupOperationsServiceWithoutRepo(t, ctx)
 
 	type setupData struct {
 		commitToMerge string
@@ -311,8 +318,13 @@ func TestUserMergeBranch(t *testing.T) {
 func TestUserMergeBranch_failure(t *testing.T) {
 	t.Parallel()
 
-	ctx := testhelper.Context(t)
+	testhelper.NewFeatureSets(featureflag.GPGSigning).Run(
+		t,
+		testUserMergeBranchFailure,
+	)
+}
 
+func testUserMergeBranchFailure(t *testing.T, ctx context.Context) {
 	ctx, cfg, client := setupOperationsServiceWithoutRepo(t, ctx)
 	repoProto, repoPath := gittest.CreateRepository(t, ctx, cfg)
 
@@ -465,7 +477,16 @@ func TestUserMergeBranch_failure(t *testing.T) {
 }
 
 func TestUserMergeBranch_quarantine(t *testing.T) {
-	ctx, cfg, repoProto, repoPath, client := setupOperationsService(t, testhelper.Context(t))
+	t.Parallel()
+
+	testhelper.NewFeatureSets(featureflag.GPGSigning).Run(
+		t,
+		testUserMergeBranchQuarantine,
+	)
+}
+
+func testUserMergeBranchQuarantine(t *testing.T, ctx context.Context) {
+	ctx, cfg, repoProto, repoPath, client := setupOperationsService(t, ctx)
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
 	// Set up a hook that parses the merge commit and then aborts the update. Like this, we
@@ -518,7 +539,16 @@ func TestUserMergeBranch_quarantine(t *testing.T) {
 }
 
 func TestUserMergeBranch_stableMergeIDs(t *testing.T) {
-	ctx, cfg, repoProto, repoPath, client := setupOperationsService(t, testhelper.Context(t))
+	t.Parallel()
+
+	testhelper.NewFeatureSets(featureflag.GPGSigning).Run(
+		t,
+		testUserMergeBranchStableMergeIDs,
+	)
+}
+
+func testUserMergeBranchStableMergeIDs(t *testing.T, ctx context.Context) {
+	ctx, cfg, repoProto, repoPath, client := setupOperationsService(t, ctx)
 
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
@@ -582,7 +612,16 @@ func TestUserMergeBranch_stableMergeIDs(t *testing.T) {
 }
 
 func TestUserMergeBranch_abort(t *testing.T) {
-	ctx, cfg, repoProto, repoPath, client := setupOperationsService(t, testhelper.Context(t))
+	t.Parallel()
+
+	testhelper.NewFeatureSets(featureflag.GPGSigning).Run(
+		t,
+		testUserMergeBranchAbort,
+	)
+}
+
+func testUserMergeBranchAbort(t *testing.T, ctx context.Context) {
+	ctx, cfg, repoProto, repoPath, client := setupOperationsService(t, ctx)
 
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
@@ -638,7 +677,16 @@ func TestUserMergeBranch_abort(t *testing.T) {
 }
 
 func TestUserMergeBranch_concurrentUpdate(t *testing.T) {
-	ctx, cfg, repoProto, repoPath, client := setupOperationsService(t, testhelper.Context(t))
+	t.Parallel()
+
+	testhelper.NewFeatureSets(featureflag.GPGSigning).Run(
+		t,
+		testUserMergeBranchConcurrentUpdate,
+	)
+}
+
+func testUserMergeBranchConcurrentUpdate(t *testing.T, ctx context.Context) {
+	ctx, cfg, repoProto, repoPath, client := setupOperationsService(t, ctx)
 
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
@@ -689,7 +737,16 @@ func TestUserMergeBranch_concurrentUpdate(t *testing.T) {
 }
 
 func TestUserMergeBranch_ambiguousReference(t *testing.T) {
-	ctx, cfg, repoProto, repoPath, client := setupOperationsService(t, testhelper.Context(t))
+	t.Parallel()
+
+	testhelper.NewFeatureSets(featureflag.GPGSigning).Run(
+		t,
+		testUserMergeBranchAmbiguousReference,
+	)
+}
+
+func testUserMergeBranchAmbiguousReference(t *testing.T, ctx context.Context) {
+	ctx, cfg, repoProto, repoPath, client := setupOperationsService(t, ctx)
 
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
@@ -747,7 +804,16 @@ func TestUserMergeBranch_ambiguousReference(t *testing.T) {
 }
 
 func TestUserMergeBranch_failingHooks(t *testing.T) {
-	ctx, cfg, repo, repoPath, client := setupOperationsService(t, testhelper.Context(t))
+	t.Parallel()
+
+	testhelper.NewFeatureSets(featureflag.GPGSigning).Run(
+		t,
+		testUserMergeBranchFailingHooks,
+	)
+}
+
+func testUserMergeBranchFailingHooks(t *testing.T, ctx context.Context) {
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
 	gittest.Exec(t, cfg, "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
 
@@ -833,7 +899,16 @@ func TestUserMergeBranch_failingHooks(t *testing.T) {
 }
 
 func TestUserMergeBranch_conflict(t *testing.T) {
-	ctx, cfg, repoProto, repoPath, client := setupOperationsService(t, testhelper.Context(t))
+	t.Parallel()
+
+	testhelper.NewFeatureSets(featureflag.GPGSigning).Run(
+		t,
+		testUserMergeBranchConflict,
+	)
+}
+
+func testUserMergeBranchConflict(t *testing.T, ctx context.Context) {
+	ctx, cfg, repoProto, repoPath, client := setupOperationsService(t, ctx)
 
 	const mergeIntoBranch = "mergeIntoBranch"
 	const mergeFromBranch = "mergeFromBranch"
@@ -884,6 +959,15 @@ func TestUserMergeBranch_conflict(t *testing.T) {
 }
 
 func TestUserMergeBranch_allowed(t *testing.T) {
+	t.Parallel()
+
+	testhelper.NewFeatureSets(featureflag.GPGSigning).Run(
+		t,
+		testUserMergeBranchAllowed,
+	)
+}
+
+func testUserMergeBranchAllowed(t *testing.T, ctx context.Context) {
 	mergeBranchHeadAfter := "ff0ac4dfa30d6b26fd14aa83a75650355270bf76"
 
 	for _, tc := range []struct {
@@ -951,7 +1035,7 @@ func TestUserMergeBranch_allowed(t *testing.T) {
 			))
 
 			ctx, cfg, repoProto, repoPath, client := setupOperationsServiceWithCfg(
-				t, testhelper.Context(t), cfg,
+				t, ctx, cfg,
 				testserver.WithBackchannelRegistry(backchannelRegistry),
 				testserver.WithTransactionManager(txManager),
 				testserver.WithHookManager(hookManager),
diff --git a/internal/gitaly/service/operations/submodules_test.go b/internal/gitaly/service/operations/submodules_test.go
index 7275389b9..7cad7be53 100644
--- a/internal/gitaly/service/operations/submodules_test.go
+++ b/internal/gitaly/service/operations/submodules_test.go
@@ -24,7 +24,10 @@ import (
 func TestUserUpdateSubmodule(t *testing.T) {
 	t.Parallel()
 
-	testhelper.NewFeatureSets(featureflag.SubmoduleWithTreeAPI).
+	testhelper.NewFeatureSets(
+		featureflag.SubmoduleWithTreeAPI,
+		featureflag.GPGSigning,
+	).
 		Run(t, testUserUpdateSubmodule)
 }